Medium Severity
Published: Oct 25, 2026
CCTV Camera scanner using the GoAhead webserver exploit
# CCTV-GoAhead-Exploit
Multi-threaded research exploit for the GoAhead webserver vulnerability (CVE-2017-5674) affecting CCTV cameras.
CVE-2017-5674 is an information disclosure in the GoAhead embedded webserver, commonly found in CCTV/DVR devices. Requesting `system.ini?loginuse&loginpas` returns the device's configuration, leaking the admin credentials in plaintext. This project demonstrates finding affected devices at scale with the Shodan IoT search engine and then verifying the disclosure with a multi-threaded script.
This project is a proof of concept and is intended for educational and research purposes only. It must only be used on systems you own or are authorized to test.
## Usage
First (requires a Shodan API key, set in `cctvscan.py`):
```
python3 cctvscan.py <File Name>
(e.g. python3 cctvscan.py scanned.txt)
```
This uses the Shodan IoT search engine to find CCTV cameras with the GoAhead vulnerability.
Second:
```
python3 cctvbrute.py <input file> <output file>
(e.g. python3 cctvbrute.py scanned.txt vuln.txt)
```
Once you have bruted the list, you can browse to the webserver by typing the IP:PORT into your browser. Then you can login with the credentials.